Skill UI

Detects abnormal AWS S3, GCS, and Azure Blob access by correlating CloudTrail data events, GCS audit logs, and Azure Storage Analytics, flagging after-hours bulk downloads, unfamiliar IPs, GetObject spikes, and feeding SOC reports.

Detect unusual AWS CloudTrail API patterns with boto3-powered lookups, statistical baselining, and behavior analysis to surface credential compromise, privilege escalation, and unauthorized access incidents for SOC workflows.

Detect unauthorized bulk downloads and cross-account transfers from AWS S3 by correlating CloudTrail data events, VPC flow logs, GuardDuty findings, Macie alerts, and access patterns to support security monitoring and incident response.

Implements AWS CloudTrail log analysis pipelines using Athena queries, CloudWatch Logs Insights, and SIEM feeds to detect unauthorized access, privilege escalation, and tampering across AWS accounts for incident response and compliance.

Guide for using CloudTrail logs, boto3, Athena, and CLI tools to reconstruct AWS attacker activity, surface compromised credentials, and document API-based incident investigations when responding to cloud breaches.

Guides teams through auditing Lambda execution roles, deriving least-privilege IAM policies from CloudTrail and Access Analyzer activity, and enforcing scoped trust/permission boundaries so serverless workloads run with minimal access.

Detects injection and privilege escalation paths in AWS/Azure/Google serverless functions by correlating CloudTrail events, static code analysis, runtime telemetry, and IAM policy reviews, helping SOC teams catch poisoned event sources, layer tampering, or eval/exec abuse before attackers execute arbitrary code.

Use AWS Athena to build partitioned forensic tables over CloudTrail, VPC Flow, S3 access, and ALB logs, then run compliant SQL hunts for unauthorized access, data exfiltration, lateral movement, and privilege escalation during AWS security investigations.